KVKK Disclosure Notice

This disclosure notice (“Notice”) is provided by Issever Co. (“Company”, “we”, “us”, “our”) in its capacity as a data controller under the Turkish Personal Data Protection Law No. 6698 (“KVKK”). This Notice explains the categories of personal data we may process, the purposes and legal bases of processing, the parties to whom data may be transferred, retention periods, and your rights.

1. Scope

This Notice applies to the processing of personal data of our website visitors, potential customers, customers, business contacts, suppliers, and other individuals who interact with our products, services, and websites (collectively, the “Services”).

2. Categories of Personal Data

Depending on your interaction with the Services, we may process the following categories of personal data:

• Identity Data: name, surname and similar identifiers (where provided).
• Contact Data: email address, phone number, address information (where provided).
• Customer/Transaction Data: service requests, contractual information, billing/transaction metadata.
• Technical & Usage Data: IP address, device identifiers, browser information, access logs, cookie identifiers, interaction and analytics events.
• Security Data: authentication events, fraud-prevention signals, security logs.

3. Purposes of Processing

We may process personal data for the following purposes:

• Providing, operating, and improving the Services
• Managing customer relations, responding to inquiries and support requests
• Contract management, invoicing, accounting, and operational administration
• Ensuring information security, access control, fraud and abuse prevention
• Complying with applicable legal obligations and responding to lawful requests
• Conducting analytics and performance monitoring to enhance user experience

4. Legal Bases (KVKK Article 5 and 6)

We process personal data in accordance with KVKK, primarily based on one or more of the following legal grounds (depending on the context):

• Explicit consent where required
• Processing is explicitly stipulated by law
• Processing is necessary for the establishment or performance of a contract, provided it is directly related to the parties of the contract
• Processing is mandatory for the data controller to fulfill its legal obligation
• Processing is necessary for the establishment, exercise, or protection of a right
• Processing is necessary for the legitimate interests of the data controller, provided that fundamental rights and freedoms of the data subject are not harmed

5. Transfers of Personal Data

We may transfer personal data to third parties strictly as necessary for the purposes described above and in accordance with KVKK and applicable legislation. Transfer recipients may include:

• Service providers (e.g., hosting, cloud infrastructure, email delivery, analytics, a/b testing, monitoring)
• Professional advisors (e.g., legal, financial, audit) where necessary
• Authorized public institutions and organizations where required by law

6. International Data Transfers

Some of our service providers may be located outside Türkiye or may store/process data on servers outside Türkiye. Where international transfers occur, we aim to take appropriate safeguards and comply with applicable KVKK requirements regarding cross-border data transfers.

7. Retention Periods

We retain personal data for as long as necessary to fulfill the purposes described in this Notice, to comply with legal obligations, and to resolve disputes. Retention periods may vary depending on the type of data and context. Where data is no longer required, it is deleted, destroyed, or anonymized in accordance with our retention and destruction practices.

8. Methods of Collection

We may collect personal data directly from you (e.g., via forms, email, phone), and indirectly through your use of the Services (e.g., through logs, cookies, and similar technologies).

9. Your Rights Under KVKK (Article 11)

Subject to applicable conditions, you have the right to:

1. Learn whether your personal data is processed
2. Request information if your personal data has been processed
3. Learn the purpose of processing and whether data is used in line with the purpose
4. Know the third parties to whom personal data is transferred domestically or abroad
5. Request correction of incomplete or inaccurate personal data
6. Request deletion or destruction of personal data under the conditions set out in KVKK
7. Request notification of correction/deletion/destruction to third parties to whom data was transferred
8. Object to a result against you arising from analysis of processed data solely through automated systems
9. Request compensation if you suffer damage due to unlawful processing

10. How to Contact Us

11. Changes to This Notice

We may update this Notice from time to time. The “Last updated” date indicates the most recent revision date. Your continued use of the Services after updates become effective indicates acceptance of the updated Notice.

This document is provided for general informational purposes and does not constitute legal advice.